CUI Attachment A.pdf

This is an Attachment A template providing additional guidelines for handling Controlled Unclassified Information (CUI) in federal contracts.

The document establishes requirements for contractors supporting government contracts that involve CUI—unclassified information requiring safeguarding due to applicable laws, regulations, and government-wide policies. CUI includes technical information related to experimental, developmental, or engineering works that can be used to define manufacturing or engineering processes, and information requiring dissemination controls per applicable law and regulation. All CUI documents must carry appropriate markings in accordance with DoD 5200.48. Contractors are required to comply with access controls, mandatory CUI training through the DoD Security Awareness Hub, and non-disclosure agreements. Physical protection requirements include storing CUI in locked containers and preventing unauthorized access. Electronic storage and processing must follow DFARS 252.204-7012. Dissemination is restricted to DoD personnel and contractors conducting authorized government business, with approval required from the Government Security Manager for external dissemination. CUI cannot be posted to publicly accessible websites. Digital transmission must use NIST/NIAP-approved encryption products and DoD-approved Public Key Infrastructure Certification. Contractors must destroy or sanitize CUI using approved methods aligned with NIST standards within specified timeframes. The contract requires reporting any loss of CUI to the Government Security Manager within 72 hours, including applicable dates, threat methodology, actions taken, and information compromised.